Executive brief
A vulnerability exists in the SourceCodester Class and Exam Timetabling System, a web application used for managing academic schedules. An attacker can inject malicious scripts into the system that execute when a user views a specific page. This could allow an attacker to perform unauthorized actions on behalf of users, steal session information, or deface the application's interface.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0. The issue is located in the '/class.php' file, where the 'day' parameter is processed without sufficient input validation or output encoding. A remote, unauthenticated attacker can craft a malicious URL containing a script payload (e.g., <script>prompt(/xss/);</script>). When a victim visits this URL, the script executes within the context of their browser session. This can lead to session hijacking via cookie theft or unauthorized state-changing actions. No official patch is currently available, but users are advised to implement output encoding and input filtering.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-06-16: disclosed: Vulnerability details and PoC published on GitHub
- 2026-07-21: advisory: NVD/VulDB advisory published